On Tuesday, October 13th, 2026 at 8:59 PM, [email protected]
<[email protected]> wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential
> issue(s) to consider.
>
> Critical: 0 · High: 2 · Medium: 0 · Low: 0
>
> If you believe none of the issues are legitimate, please reply to each
> issue of Medium severity or higher and explain why the AI is wrong.
> If any of them are legitimate and you plan to respin, please let patchwork
> know by including "pw-bot: cr" as a separate line at the end of your reply
> (one such reply per series is enough).
>
> - [High] The patch fixes the TSIP length underflow only in
> igc_clean_rx_irq().
> - [High] In igc_clean_rx_irq(), the new condition `if (!skb &&
> igc_test_staterr(rx_desc, IGC_RXDADV_STAT_TSIP))` uses `!skb` to mean…
>
> --
>
> igc: only strip RX timestamp header from first buffer
>
> This patch changes igc_clean_rx_irq() so the 16-byte inline RX timestamp
> header is only stripped when no skb is in progress. Before, a continuation
> buffer shorter than 16 bytes could underflow the unsigned length and
> produce a skb fragment of almost 4 GiB.
>
> > diff --git a/drivers/net/ethernet/intel/igc/igc_main.c
> > b/drivers/net/ethernet/intel/igc/igc_main.c
> > index 1fb5f3cbe93c5..41b293dc10c3a 100644
> > --- a/drivers/net/ethernet/intel/igc/igc_main.c
> > +++ b/drivers/net/ethernet/intel/igc/igc_main.c
> > @@ -2639,7 +2639,8 @@ static int igc_clean_rx_irq(struct igc_q_vector
> > *q_vector, const int budget)
> >
> > pktbuf = page_address(rx_buffer->page) + rx_buffer->page_offset;
> >
> > - if (igc_test_staterr(rx_desc, IGC_RXDADV_STAT_TSIP)) {
> > + if (!skb &&
> > + igc_test_staterr(rx_desc, IGC_RXDADV_STAT_TSIP)) {
>
> [Severity: High]
> Is !skb a reliable first-buffer test when an XDP program is attached?
>
> Suppose the XDP program returns a non-PASS verdict (CONSUMED, TX or
> REDIRECT) for the first, non-EOP buffer of a multi-descriptor frame. No skb
> gets built, and the loop moves on with skb still NULL:
>
> /* fetch next buffer in frame if non-eop */
> if (igc_is_non_eop(rx_ring, rx_desc))
> continue;
>
> On the next continuation descriptor, !skb is still true, so the TSIP branch
> subtracts IGC_TS_HDR_LEN again. If that continuation holds fewer than 16
> bytes, size wraps.
>
> The wrapped size then goes to xdp_prepare_buff(), and the continuation is
> run through XDP as a new frame with data_end before data. On XDP_PASS, both
> igc_build_skb() and igc_construct_skb() compute:
>
> unsigned int size = xdp->data_end - xdp->data;
>
> That comes out to about 4 GiB:
>
> - igc_build_skb() passes it to __skb_put(). On PAGE_SIZE >= 8192,
> igc_get_rx_frame_truesize() also wraps to a tiny truesize, so
> napi_build_skb() would place skb_shared_info inside the packet data.
> - igc_construct_skb() turns it into a fragment of almost 4 GiB. That looks
> like the same corrupted skb the commit message describes.
>
> Can this be reached from the wire? On PAGE_SIZE >= 8192, igc_set_rx_mode()
> never clamps RLPML:
>
> #if (PAGE_SIZE < 8192)
> if (adapter->max_frame_size <= IGC_MAX_FRAME_BUILD_SKB)
> rlpml = IGC_MAX_FRAME_BUILD_SKB;
> #endif
> wr32(IGC_RLPML, rlpml);
>
> So the hardware still accepts jumbo frames even though XDP limits the MTU to
> 1500, and with XDP the ring uses 3072-byte buffers. A remote frame that
> leaves 1 to 15 bytes in the second descriptor would hit this.
>
> Would it be safer to track start-of-frame explicitly, or to drop the rest of
> the frame's descriptors after a non-PASS verdict? Another option is to
> reject size < IGC_TS_HDR_LEN before the subtraction.
>
> > ctx.rx_ts = pktbuf;
> > pkt_offset = IGC_TS_HDR_LEN;
> > size -= IGC_TS_HDR_LEN;
>
> [Severity: High]
> The same unchecked subtraction is still present in the AF_XDP zero-copy
> path. igc_clean_rx_irq_zc() strips the header from every descriptor with
> TSIP set. There is no first-buffer gate and no size check:
>
> if (igc_test_staterr(desc, IGC_RXDADV_STAT_TSIP)) {
> ctx->rx_ts = bi->xdp->data;
>
> bi->xdp->data += IGC_TS_HDR_LEN;
> ...
> size -= IGC_TS_HDR_LEN;
> } else {
> ctx->rx_ts = NULL;
> }
>
> bi->xdp->data_end = bi->xdp->data + size;
>
> Can zero-copy frames span descriptors at MTU 1500?
> igc_configure_rx_ring() programs the XSK frame size through
> IGC_SRRCTL_BSIZEPKT(), which is (x) / 1024. With 2048-byte chunks the frame
> size is 1792, so the hardware buffer becomes 1 KB.
>
> igc_xdp_enable_pool() only checks:
>
> if (frame_size < ETH_FRAME_LEN + VLAN_HLEN * 2) {
>
> That accepts 1792 without allowing for the 1 KB rounding or the 16-byte
> inline timestamp, even though the comment there says frames should not
> span multiple buffers.
>
> On 4K pages RLPML is IGC_MAX_FRAME_BUILD_SKB. A received frame of about
> 1009 to 1023 bytes, plus the timestamp header, would leave 1 to 15 bytes in
> a second descriptor.
>
> The reproduction in the commit message suggests TSIP is set on such
> continuation descriptors. If so, size wraps here and data_end ends up about
> 4 GiB past the XSK chunk.
>
> Wouldn't that let the XDP program's packet bounds checks pass for offsets
> past the chunk? On XDP_REDIRECT, it would also report a bogus length to the
> XSK socket.
>
> Should igc_clean_rx_irq_zc() get a similar fix? Should
> igc_xdp_enable_pool() also account for the 1 KB SRRCTL granularity and the
> inline timestamp?
>
> --
> Sashiko AI review ·
> https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261013010854.4068874-1-p%401g4.org
>
Yes, there's work needed elsewhere, but it's entirely independent of my fix.
It's
questionable how much of this is even reachable and if any impact whatsoever.
Here's what I can reproduce with and without kasan and what my patch fixes. You
are on your
own on the rest.
I'm sorry, if only there were more time...
Good luck.
[ 981.289013]
==================================================================
[ 981.289028] BUG: KASAN: slab-use-after-free in sk_skb_reason_drop+0x36/0x280
[ 981.289051] Write of size 4 at addr ffff888201376fd4 by task kworker/7:2/92
[ 981.289069] CPU: 7 UID: 0 PID: 92 Comm: kworker/7:2 Tainted: G W
7.3.0-rc6+ #4 PREEMPT
[ 981.289083] Tainted: [W]=WARN
[ 981.289088] Workqueue: events igc_reset_task [igc]
[ 981.289152] Call Trace:
[ 981.289158] <TASK>
[ 981.289163] dump_stack_lvl+0x43/0x60
[ 981.289177] print_address_description+0x55/0x1d0
[ 981.289188] ? sk_skb_reason_drop+0x36/0x280
[ 981.289196] print_report+0x58/0x70
[ 981.289203] kasan_report+0x117/0x150
[ 981.289213] ? dev_kfree_skb_any_reason+0x4/0x180
[ 981.289221] ? sk_skb_reason_drop+0x36/0x280
[ 981.289229] kasan_check_range+0x3c7/0x3f0
[ 981.289238] sk_skb_reason_drop+0x36/0x280
[ 981.289246] igc_clean_tx_ring+0x24a/0xb40 [igc]
[ 981.289296] igc_down+0x7b1/0xc70 [igc]
[ 981.289339] igc_reinit_locked+0x5a/0x80 [igc]
[ 981.289379] igc_reset_task+0xca/0xd0 [igc]
[ 981.289418] process_scheduled_works+0x805/0xf10
[ 981.289435] worker_thread+0x8d2/0xc60
[ 981.289443] ? __schedule+0x1011/0x2330
[ 981.289462] kthread+0x2c9/0x3a0
[ 981.289468] ? __pfx_worker_thread+0x10/0x10
[ 981.289477] ? __pfx_kthread+0x10/0x10
[ 981.289487] ret_from_fork+0x14d/0x3f0
[ 981.289496] ? __pfx_kthread+0x10/0x10
[ 981.289505] ret_from_fork_asm+0x1a/0x30
[ 981.289517] </TASK>
[ 981.289523] Allocated by task 0:
[ 981.289529] kasan_save_track+0x3e/0x80
[ 981.289541] __kasan_mempool_unpoison_object+0x82/0x110
[ 981.289548] __alloc_skb+0x2c3/0x8f0
[ 981.289559] napi_alloc_skb+0x58/0x220
[ 981.289565] igc_poll+0x400f/0x7660 [igc]
[ 981.289604] __napi_poll+0x91/0x380
[ 981.289612] net_rx_action+0x4e0/0xbc0
[ 981.289620] handle_softirqs+0x173/0x4d0
[ 981.289630] __irq_exit_rcu+0x63/0xd0
[ 981.289639] common_interrupt+0x81/0x90
[ 981.289648] asm_common_interrupt+0x26/0x40
[ 981.289658] Freed by task 0:
[ 981.289662] kasan_save_track+0x3e/0x80
[ 981.289671] kasan_save_free_info+0x40/0x50
[ 981.289678] __kasan_slab_free+0x3a/0x60
[ 981.289684] kmem_cache_free+0xe9/0x370
[ 981.289693] br_stp_rcv+0x39a/0x1390
[ 981.289701] stp_pdu_rcv+0x227/0x370
[ 981.289710] llc_rcv+0x552/0x8d0
[ 981.289718] __netif_receive_skb_list_core+0x600/0x790
[ 981.289726] netif_receive_skb_list_internal+0x6f0/0x940
[ 981.289734] napi_complete_done+0x1a6/0x400
[ 981.289741] igc_poll+0x5c6d/0x7660 [igc]
[ 981.289779] __napi_poll+0x91/0x380
[ 981.289786] net_rx_action+0x4e0/0xbc0
[ 981.289794] handle_softirqs+0x173/0x4d0
[ 981.289802] __irq_exit_rcu+0x63/0xd0
[ 981.289811] common_interrupt+0x81/0x90
[ 981.289819] asm_common_interrupt+0x26/0x40
[ 981.289828] The buggy address belongs to the object at ffff888201376f00
which belongs to the cache skbuff_head_cache of size 224
[ 981.289836] The buggy address is located 212 bytes inside of
freed 224-byte region [ffff888201376f00, ffff888201376fe0)
[ 981.289847] The buggy address belongs to the physical page:
[ 981.289854] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
pfn:0x201376
[ 981.289864] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0
pincount:0
[ 981.289870] flags: 0x100000000000040(head|node=0|zone=1)
[ 981.289879] page_type: f5(slab)
[ 981.289889] raw: 0100000000000040 ffff8881003437c0 dead000000000100
dead000000000122
[ 981.289897] raw: 0000000000000000 0000000000190019 00000000f5000000
0000000000000000
[ 981.289903] head: 0100000000000040 ffff8881003437c0 dead000000000100
dead000000000122
[ 981.289909] head: 0000000000000000 0000000000190019 00000000f5000000
0000000000000000
[ 981.289915] head: 0100000000000001 ffffffffffffff81 00000000ffffffff
00000000ffffffff
[ 981.289920] head: 0000000000000000 0000000000000000 00000000ffffffff
0000000000000000
[ 981.289923] page dumped because: kasan: bad access detected
[ 981.289930] Memory state around the buggy address:
[ 981.289935] ffff888201376e80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
fc
[ 981.289940] ffff888201376f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb
[ 981.289945] >ffff888201376f80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
fc
[ 981.289948] ^
[ 981.289953] ffff888201377000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
fb
[ 981.289957] ffff888201377080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb
[ 981.289960]
==================================================================
[ 981.289964] Disabling lock debugging due to kernel taint
[ 981.289972] ------------[ cut here ]------------
[ 981.289976] refcount_t: underflow; use-after-free.
[ 981.289980] WARNING: at refcount_warn_saturate+0x84/0xd0, CPU#7:
kworker/7:2/92
[ 986.631187] Modules linked in: igc
[ 986.672125] CPU: 7 UID: 0 PID: 92 Comm: kworker/7:2 Tainted: G B W
7.3.0-rc6+ #4 PREEMPT
[ 986.786934] Tainted: [B]=BAD_PAGE, [W]=WARN
[ 986.837256] Workqueue: events igc_reset_task [igc]
[ 986.895096] RIP: 0010:refcount_warn_saturate+0x84/0xd0
[ 986.957010] Code: 74 2f 83 fb 01 75 38 48 8d 3d 1c 18 0b 03 67 48 0f b9 3a
eb 36 48 8d 3d 1a 18 0b 03 67 48 0f b9 3a eb 28 48 8d 3d 18 18 0b 03 <67> 48 0f
b9 3a eb 1a 48 8d 3d 16 18 0b 03 67 48 0f b9 3a eb 0c 48
[ 987.182580] RSP: 0018:ffffc9000073faa0 EFLAGS: 00010246
[ 987.246116] RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffffb7e3a117
[ 987.331872] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffffbaeeb8ec
[ 987.418053] RBP: ffffc900012b7440 R08: 0000000000000007 R09: 00000000fffffffb
[ 987.503797] R10: dffffc0000000000 R11: ffffed104026edfa R12: ffff888204c57288
[ 987.589959] R13: 000000000000e0e8 R14: ffff888201376fd4 R15: 0000000000000011
[ 987.675711] FS: 0000000000000000(0000) GS:ffff888864da5000(0000)
knlGS:0000000000000000
[ 987.773233] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 987.843183] CR2: 00007dc52cee8781 CR3: 0000000113426001 CR4: 0000000000f70ef0
[ 987.929069] PKRU: 55555554
[ 987.961732] Call Trace:
[ 987.991154] <TASK>
[ 988.016584] igc_clean_tx_ring+0x24a/0xb40 [igc]
[ 988.072122] igc_down+0x7b1/0xc70 [igc]
[ 988.118496] igc_reinit_locked+0x5a/0x80 [igc]
[ 988.172072] igc_reset_task+0xca/0xd0 [igc]
[ 988.222531] process_scheduled_works+0x805/0xf10
[ 988.278089] worker_thread+0x8d2/0xc60
[ 988.323413] ? __schedule+0x1011/0x2330
[ 988.369478] kthread+0x2c9/0x3a0
[ 988.408473] ? __pfx_worker_thread+0x10/0x10
[ 988.459993] ? __pfx_kthread+0x10/0x10
[ 988.505192] ret_from_fork+0x14d/0x3f0
[ 988.550284] ? __pfx_kthread+0x10/0x10
[ 988.595629] ret_from_fork_asm+0x1a/0x30
[ 988.642823] </TASK>
[ 988.669290] ---[ end trace 0000000000000000 ]---
[ 2138.124024] [Poison overwritten] 0xffff91bb928da594-0xffff91bb928da594
@offset=1428. First byte 0x6a instead of 0x6b
[ 2138.124040]
=============================================================================
[ 2138.124044] BUG skbuff_head_cache (Tainted: G W ): Object
corrupt
[ 2138.124049]
-----------------------------------------------------------------------------
[ 2138.124051] Allocated in kmem_cache_alloc_bulk_noprof+0x8d/0x370 age=89089
cpu=4 pid=0
[ 2138.124068] kmem_cache_alloc_bulk_noprof+0x8d/0x370
[ 2138.124075] __alloc_skb+0x35c/0x3b0
[ 2138.124080] napi_alloc_skb+0x4c/0x110
[ 2138.124083] igc_poll+0xf1f/0x1c80 [igc]
[ 2138.124108] __napi_poll+0x2f/0x190
[ 2138.124115] net_rx_action+0x299/0x4c0
[ 2138.124121] handle_softirqs+0xd1/0x2a0
[ 2138.124128] do_softirq+0x4b/0x70
[ 2138.124132] flush_smp_call_function_queue+0x43/0x60
[ 2138.124138] do_idle+0x1b4/0x210
[ 2138.124145] cpu_startup_entry+0x29/0x30
[ 2138.124150] start_secondary+0x95/0xa0
[ 2138.124157] common_startup_64+0x12c/0x147
[ 2138.124162] Freed in __tcf_kfree_skb_list+0x38/0xc0 age=84826 cpu=4 pid=0
[ 2138.124172] __tcf_kfree_skb_list+0x38/0xc0
[ 2138.124177] __dev_queue_xmit+0xbe1/0xf20
[ 2138.124181] tcf_mirred_to_dev+0x41c/0x4a0
[ 2138.124187] tcf_mirred_act+0x30f/0x670
[ 2138.124192] tcf_action_exec+0x95/0x220
[ 2138.124196] tcf_classify+0x8e/0x200
[ 2138.124202] tc_run+0xc7/0x120
[ 2138.124207] __netif_receive_skb_core+0x4d5/0xc60
[ 2138.124212] __netif_receive_skb_list_core+0xbc/0x290
[ 2138.124217] netif_receive_skb_list_internal+0x178/0x2e0
[ 2138.124222] napi_complete_done+0x99/0x150
[ 2138.124226] igc_poll+0x16da/0x1c80 [igc]
[ 2138.124246] __napi_poll+0x2f/0x190
[ 2138.124251] net_rx_action+0x299/0x4c0
[ 2138.124256] handle_softirqs+0xd1/0x2a0
[ 2138.124261] __irq_exit_rcu+0x44/0xa0
[ 2138.124265] Slab 0xffffd132cb4a3680 objects=21 used=19 fp=0xffff91bb928db9c0
flags=0x100000000000240(workingset|head|node=0|zone=1)
[ 2138.124274] Object 0xffff91bb928da4c0 @offset=1216 fp=0xffff91bb928db9c0
[ 2138.124278] Redzone ffff91bb928da480: bb bb bb bb bb bb bb bb bb bb bb bb
bb bb bb bb ................
[ 2138.124282] Redzone ffff91bb928da490: bb bb bb bb bb bb bb bb bb bb bb bb
bb bb bb bb ................
[ 2138.124284] Redzone ffff91bb928da4a0: bb bb bb bb bb bb bb bb bb bb bb bb
bb bb bb bb ................
[ 2138.124286] Redzone ffff91bb928da4b0: bb bb bb bb bb bb bb bb bb bb bb bb
bb bb bb bb ................
[ 2138.124289] Object ffff91bb928da4c0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2138.124291] Object ffff91bb928da4d0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2138.124293] Object ffff91bb928da4e0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2138.124295] Object ffff91bb928da4f0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2138.124297] Object ffff91bb928da500: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2138.124299] Object ffff91bb928da510: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2138.124301] Object ffff91bb928da520: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2138.124302] Object ffff91bb928da530: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2138.124304] Object ffff91bb928da540: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2138.124306] Object ffff91bb928da550: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2138.124308] Object ffff91bb928da560: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2138.124309] Object ffff91bb928da570: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2138.124311] Object ffff91bb928da580: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2138.124313] Object ffff91bb928da590: 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b
6b 6b 6b a5 kkkkjkkkkkkkkkk.
[ 2138.124315] Redzone ffff91bb928da5a0: bb bb bb bb bb bb bb bb
........
[ 2138.124317] Padding ffff91bb928da5f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a
5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
[ 2138.124320] Disabling lock debugging due to kernel taint
[ 2138.124337] ------------[ cut here ]------------
[ 2138.124339] WARNING: at object_err+0xa7/0xd0, CPU#6: swapper/6/0
[ 2138.124375] Modules linked in: igc
[ 2138.124385] CPU: 6 UID: 0 PID: 0 Comm: swapper/6 Tainted: G B W
7.3.0-rc6-nokasan+ #5 PREEMPT
[ 2138.124394] Tainted: [B]=BAD_PAGE, [W]=WARN
[ 2138.124398] RIP: 0010:object_err+0xa7/0xd0
[ 2138.124403] Code: 85 d2 74 3d 4c 89 f7 e8 87 fe ff ff 48 c7 c7 0b 28 d7 8b
48 89 de e8 e8 cf ff ff bf 05 00 00 00 be 01 00 00 00 e8 99 ae 12 00 <0f> 0b 5b
41 5e 41 5f c3 cc cc cc cc cc 48 99 48 f7 fe 48 85 d2 75
[ 2138.124408] RSP: 0018:ffffab8bc02f4a30 EFLAGS: 00010046
[ 2138.124414] RAX: 0000000000000000 RBX: ffff91bb928da4c0 RCX: f49708951d977900
[ 2138.124418] RDX: 3fffffffffffdfff RSI: 0000000000000000 RDI: 0000000000000005
[ 2138.124422] RBP: ffff91b9c0b967c0 R08: 0000000000001fff R09: ffffffff8c45c8f0
[ 2138.124425] R10: 0000000000005ffd R11: ffffffff8c45c8f0 R12: ffffffff8bd8ed9a
[ 2138.124429] R13: ffff91bb928da594 R14: ffffd132cb4a3680 R15: ffff91b9c0b967c0
[ 2138.124431] FS: 0000000000000000(0000) GS:ffff91c192d95000(0000)
knlGS:0000000000000000
[ 2138.124436] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2138.124440] CR2: 0000000000e9ac50 CR3: 0000000150f91005 CR4: 0000000000f70ef0
[ 2138.124444] PKRU: 55555554
[ 2138.124447] Call Trace:
[ 2138.124450] <IRQ>
[ 2138.124453] check_bytes_and_report+0xea/0x110
[ 2138.124461] check_object+0x131/0x360
[ 2138.124467] alloc_debug_processing+0xaf/0x1a0
[ 2138.124472] get_from_partial_node+0x11c/0x410
[ 2138.124478] ___slab_alloc+0xad/0x760
[ 2138.124484] __kmem_cache_alloc_bulk+0x13c/0x190
[ 2138.124490] ? kmem_cache_alloc_bulk_noprof+0x8d/0x370
[ 2138.124499] kmem_cache_alloc_bulk_noprof+0x8d/0x370
[ 2138.124506] __alloc_skb+0x35c/0x3b0
[ 2138.124511] napi_alloc_skb+0x4c/0x110
[ 2138.124514] igc_poll+0xf1f/0x1c80 [igc]
[ 2138.124538] __napi_poll+0x2f/0x190
[ 2138.124544] net_rx_action+0x299/0x4c0
[ 2138.124552] handle_softirqs+0xd1/0x2a0
[ 2138.124559] __irq_exit_rcu+0x44/0xa0
[ 2138.124564] common_interrupt+0x81/0x90
[ 2138.124570] </IRQ>
[ 2138.124571] <TASK>
[ 2138.124574] asm_common_interrupt+0x26/0x40
[ 2138.124578] RIP: 0010:mwait_idle+0x49/0x60
[ 2138.124586] Code: 80 0e 40 48 f7 06 10 00 00 00 75 1f 48 89 f0 0f 1f 00 31
c9 31 d2 0f 01 c8 48 f7 06 10 00 00 00 75 09 31 c0 31 c9 fb 0f 01 c9 <fa> f0 80
26 bf c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
[ 2138.124590] RSP: 0018:ffffab8bc01abef8 EFLAGS: 00000246
[ 2138.124594] RAX: 0000000000000000 RBX: ffffab8bc01abf0f RCX: 0000000000000000
[ 2138.124597] RDX: 0000000000000000 RSI: ffff91b9c0959080 RDI: 000000000066674c
[ 2138.124600] RBP: 0000000000000000 R08: 0000000000000402 R09: 0000000000001c00
[ 2138.124603] R10: 0000000000000000 R11: ffffffff8a78a5e0 R12: ffff91b9c0959080
[ 2138.124605] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 2138.124609] ? __pfx_set_next_task_idle+0x10/0x10
[ 2138.124619] default_idle_call+0x39/0x60
[ 2138.124626] do_idle+0xbd/0x210
[ 2138.124632] cpu_startup_entry+0x29/0x30
[ 2138.124639] start_secondary+0x95/0xa0
[ 2138.124645] common_startup_64+0x12c/0x147
[ 2138.124652] </TASK>
[ 2138.124654] ---[ end trace 0000000000000000 ]---
